English 中文(简体)
• 在 CI环境中保存一个GPG秘密项目的关键?
原标题:Where to keep a GPG secret key for a Maven project in CI environment?

I m 试图使用maven-gpg-plugin:sign,以便在部署到Sonatype OSS存放处之前签署项目工艺品。 问题在于,我应保留我的秘密钥匙,其中附有gpg:

  1. In continuous integration ~/.gnupg directory
  2. In project source code, e.g. src/test/resources/gpg/secring.gpg

为什么?

最佳回答

If key is sensitive put it in ~/.gnupg directory on CI server and protect that directory with proper access modifiers. 2nd approach will allow every developer with access to project to see key.

问题回答

暂无回答




相关问题
Spring Properties File

Hi have this j2ee web application developed using spring framework. I have a problem with rendering mnessages in nihongo characters from the properties file. I tried converting the file to ascii using ...

Logging a global ID in multiple components

I have a system which contains multiple applications connected together using JMS and Spring Integration. Messages get sent along a chain of applications. [App A] -> [App B] -> [App C] We set a ...

Java Library Size

If I m given two Java Libraries in Jar format, 1 having no bells and whistles, and the other having lots of them that will mostly go unused.... my question is: How will the larger, mostly unused ...

How to get the Array Class for a given Class in Java?

I have a Class variable that holds a certain type and I need to get a variable that holds the corresponding array class. The best I could come up with is this: Class arrayOfFooClass = java.lang....

SQLite , Derby vs file system

I m working on a Java desktop application that reads and writes from/to different files. I think a better solution would be to replace the file system by a SQLite database. How hard is it to migrate ...

热门标签